From: Mickaël Salaün > Sent: 07 May 2020 09:37 ... > > None of that description actually says what the patch actually does. > > "Add support for O_MAYEXEC" "to enable to control script execution". > What is not clear here? This seems well understood by other commenters. > The documentation patch and the talks can also help. I'm guessing that passing O_MAYEXEC to open() requests the kernel check for execute 'x' permissions (as well as read). Then kernel policy determines whether 'read' access is actually enough, or whether 'x' access (possibly masked by mount permissions) is needed. If that is true, two lines say what is does. Have you ever set a shell script permissions to --x--s--x ? Ends up being executable by everyone except the owner! Having the kernel pass all '#!' files to their interpreters through an open fd might help security. In that case the user doesn't need read access to the file in order to get an interpreter to process it. (You'd need to stop strace showing the contents to actually hide them.) David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
